all use of http instead of forcing https